Extortion and ransom language in 8-K cyber filings

What the four filings cover

This guide compares how four companies wrote about extortion, stolen data and encryption in Item 1.05 ("Material Cybersecurity Incident") of Form 8-K. The four filings are Coinbase Global (filed May 15, 2025), Jewett-Cameron Trading Company (filed October 21, 2025), Brandywine Realty Trust (an 8-K/A signed May 28, 2024) and Data I/O Corporation (filed September 10, 2025). The wording differs a lot between them. Only one of the four says anything direct about whether a payment was made. We quote each filing and say where it is silent.

Brandywine's document is an amendment. Its explanatory note says it amends the original report the company filed, and that the amendment supplements Item 1.05 of that report. Anything the original report said about the incident is outside what we reviewed.

How the filings describe an extortion demand

Two of the four filings describe a demand for money. They describe it in different ways.

Coinbase says the contact came by email from a threat actor on May 11, 2025. The filing states the terms of the demand in one sentence. Coinbase then says it judged the claim to be genuine.

Jewett-Cameron describes a threat to publish, tied to a payment. The filing says the company learned of the intrusion on October 15, 2025. On the demand, it says: The filing gives no amount. It also does not say whether the company responded.

Brandywine's amendment and Data I/O's filing do not describe any demand in the text we reviewed. Neither mentions a threat to publish, a deadline or a payment request.

How the filings describe data theft

Each filing uses a different level of detail about what was taken.

Coinbase gives the most. It says the actor appears to have obtained the data by paying insiders. The filing says the company's own monitoring detected the improper access in the previous months. It lists the data types it was still investigating, including names, addresses, phone numbers, emails, masked Social Security numbers, masked bank-account numbers, government ID images, account balance snapshots and transaction history. It also states what was not affected.

Jewett-Cameron is more cautious. The company says it knows data left its systems but has not finished assessing it. It names the material it believes was taken. On personal data, it says:

Brandywine says exfiltration took place and that some of the files held personal information. The company says its assessment of how much personal information was involved is still going, and that it intends to give required notifications to affected parties and regulators.

Data I/O's filing does not mention data theft in the text we reviewed.

How the filings describe encryption and ransomware

Three filings refer to encryption or ransomware, and they use different words for it.

Jewett-Cameron and Brandywine use nearly the same sentence structure: unauthorized access, then deployment of encryption. Jewett-Cameron says the company believes the incident consisted of . Brandywine says the third party carried out . Neither filing uses the word "ransomware" in the text we reviewed.

Data I/O is the one filing that uses the word. It refers back to an earlier 8-K and calls the event a ransomware incident. The earlier filing was not among the documents we reviewed. The filing then gives a cause:

Coinbase's incident did not involve encryption at all, according to its filing. The company describes a data-theft and extortion event carried out through insiders.

Operational effects and costs

The filings that describe encryption also describe outages. The wording on which systems were affected is specific.

Data I/O lists the operations affected. It also gives a cost figure.

Jewett-Cameron says it took business applications offline itself. It also says insurance should cover costs.

Brandywine makes a similar insurance statement.

Coinbase gives a range rather than a point estimate. The company adds that the range is before further review of losses, indemnification claims and potential recoveries.

What the filings say about ransom payment and negotiation

Only Coinbase addresses payment directly. The filing does not describe any negotiation, any contact with the actor after May 11, 2025, or the amount demanded.

Coinbase also covers payments made by its customers to the actor. It says it intends to reimburse eligible retail customers who sent funds as a direct result of the incident.

Jewett-Cameron states the demand but says nothing about paying it or negotiating. The filing does say what the company did in the first stage.

Brandywine and Data I/O do not mention ransom payment or negotiation anywhere in the text we reviewed. Brandywine's amendment says the third party has been removed and access to the affected information has been restored. The filing does not say how access was restored. Data I/O says it restored its systems and that the incident is contained. That filing also does not say how.

Reading the gaps

Taken together, the filings show that an Item 1.05 disclosure does not have to address extortion at all. Two of the four mention a demand. One states that it has not paid. None of the four discloses an amount demanded, a negotiation or a communication channel beyond Coinbase's reference to an email.

The filings also treat the same technical event in different terms. Jewett-Cameron and Brandywine describe encryption deployment without the word ransomware, while Data I/O uses it. A reader comparing filings by keyword would miss that overlap.

Each of these points describes the text of four filings. It does not say what happened behind them, and it does not measure how other companies write. The filings themselves say their investigations were ongoing at the time of writing. Jewett-Cameron's says the full scope, nature and impact of the incident were not yet known. Coinbase's says the full impact of these events was not yet known.